Privacy Policy
Who we are
Tic Tac Brawl is operated by Jurij Kuzmin, Frýdecká 441, Letňany, 199 00 Praha 9, Czech Republic, IČO 11701820 — the “data controller” for the purposes of the GDPR.
Contact for anything on this page, including privacy requests and account deletion: [email protected].
Who can play
TicTacBrawl is for players aged 13 and over. It is not directed at children under 13 and we do not knowingly collect their data. Some countries set a higher age than 13 before certain data can be used on the basis of consent; where that applies to you, we rely on it only where we are allowed to. If you believe a child below the applicable age is using the game, write to us and we will delete the account.
What we collect
You can play as a guest — no registration, no real name. When you play, we collect:
- Account and device data — a random account ID, your chosen display name, a random device ID, an Android install identifier, device model, system version, language and time zone, screen size and network type (Wi‑Fi/cellular).
- IP address and approximate location — the IP address you connect from and the approximate location (country, region, city) derived from it on our servers. We never collect precise (GPS) location.
- Gameplay and usage data.
- Technical diagnostics — crash reports, error events, performance and connection-quality measurements.
- Email address — only if you choose to link your account (email or Google sign‑in); never required to play.
- Purchases — if you buy something, we record the store’s purchase receipt to deliver and restore what you bought. Payment details stay with Google Play; we never see them.
- Push notification token — if you allow notifications, a token identifying your device is created by Google Firebase Cloud Messaging and stored by us so we can send you a notification. You can switch notifications off on your device or in the game at any time, and the token stops being used.
- Reports you make or receive — if you report a display name, we record which account reported which name and the reason you chose. See “Reporting and moderation” below.
What other players can see
Your display name is public. Your opponent sees it in every match and it appears on the public leaderboard alongside your rank and season results. Nothing else about you is shown to other players — not your email, not your device, not your location. Please choose a name accordingly.
Why, and on what legal basis
- Running the game (performance of contract) — accounts, matches, purchases, delivering what you bought.
- Improving and debugging the game (your consent, given on the first-launch screen) — gameplay/usage data, diagnostics, approximate location. You can withdraw this at any time; see “Your rights”.
- Security and abuse prevention (legitimate interest) — IP addresses and device identifiers used for rate limiting and cheat/fraud prevention.
- Keeping the game usable for everyone (legitimate interest) — handling reports about display names and applying sanctions where a name breaks our Content Policy.
- Notifications (your consent, given when your device asks) — the push token described above.
- Rewarded ads — if you choose to watch an ad, Google AdMob processes your advertising ID. Where the law requires consent for this, you are asked for it before any ad is requested, and if you decline, no ad is shown. See Google’s own privacy policy.
Reporting and moderation
If you report a display name, we record that your account made the report, which name it was about and the reason you selected, so that a person can look at it. The player you report is not told who reported them. If we warn, mute, suspend or close an account, we keep a record of that decision and why — we need it to apply sanctions consistently and to reverse one if we got it wrong.
How long we keep it
IP addresses are deleted automatically after a short period (currently around 30 days). Detailed usage events and crash payloads are kept for a few months; only aggregated, non-identifying statistics are kept longer. Records of reports and of moderation decisions are kept while the account exists. Account data is kept while your account exists.
Who we share it with, and where it goes
We do not sell your data and we do not share it for others’ marketing. Our analytics and crash tools run on our own servers in the European Union.
We use a small number of outside providers: Google (Play billing, optional Google sign‑in, Firebase Cloud Messaging for notifications, and AdMob for rewarded ads) and Cloudflare (network delivery). Each processes data under its own terms, as our processor or, in Google’s case, as an independent controller for its own purposes.
Some of this involves your data leaving the European Economic Area, principally to the United States — in particular your push notification token, which is handled by Google’s infrastructure, and data processed by Google and Cloudflare. Where that happens we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission’s Standard Contractual Clauses.
Your rights and deleting your account
Under the GDPR you can ask for access, correction, erasure, restriction or portability, and you can withdraw consent at any time — withdrawing it does not affect anything we did while it was given.
You can delete your account yourself in the game under Settings › Account, or as described at /legal/delete-account. If you play as a guest and have no way to sign in, that page explains how to delete your account using your Support ID — you do not need an account to ask us to delete one. Deletion takes effect after a short undo window, after which your personal data is erased or irreversibly anonymised (some aggregate, non-identifying statistics and legally required purchase records remain).
You also have the right to complain to a data protection supervisory authority. Ours is the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz — and you may also complain to the authority in the country where you live.
Changes
If we materially change what we collect, we will update this policy, raise the version number at the top of this page, and ask for your consent again on the next launch.